TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2026-08-19

5 sections16 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

HEIGHTS FINANCE DATA BREACH IMPACTS AT LEAST 1.2 MILLION INDIVIDUALS

Heights Finance says attackers accessed a third-party cloud platform in early May, exposing data on more than 1.2 million people. Stolen records included Social Security numbers, government IDs, bank details, birth dates, and contact information. The lender says loan-management systems were untouched, federal law enforcement was notified, and affected people receive 24 months of credit monitoring and identity protection.

links.tldrnewsletter.com2 min read

FRENCH TAX AUTHORITY ADMITS DATA HEIST AFTER CROOK TOUTS 2M RECORDS

France's tax authority (DGFiP) confirmed that a threat actor accessed their systems in June. A forum user, ZeroBytes, claimed stolen credentials and an MFA bypass exposed data on more than two million taxpayers. DGFiP says the access was cut off during a June audit and rejects claims of ongoing access. It is identifying affected people, will notify France's data protection watchdog, and plans user notifications.

theregister.com2 min read

UNISOC VOLTE VIDEO CALL EXPLOIT CHAIN CAN GIVE ATTACKERS FULL ANDROID KERNEL ACCESS

Researchers at SSD Secure Disclosure have detailed a two-stage exploit chain targeting Unisoc modem firmware that allows an attacker operating a malicious 4G network to achieve full Android kernel access when a victim answers a VoLTE video call. The exploit utilizes a preliminary remote code execution payload to overwrite the ARM Memory Protection Unit, successfully mapping the entire 32-bit physical address space as readable, writable, and executable from the modem context. Unisoc has not responded to the disclosure or issued a patch, so users of affected devices like the Motorola E13, Realme C33, and Xiaomi Redmi A5 remain highly vulnerable until manufacturers release custom firmware updates.

thehackernews.com4 min read

02STRATEGIES & TACTICS

THOUSANDS OF HACKED WORDPRESS SITES, ONE OPERATION: UNMASKING STOPANDPROTECT

A massive malware operation leveraging 2,000 compromised WordPress sites is tricking visitors with fake Cloudflare CAPTCHAs to execute malicious PowerShell commands. Researchers attributed the sprawling campaign to a single operator who accidentally infected their own machine, leaking their Visual Basic 6 management tools and exposing over 6,000 victim IPs. Security teams should proactively hunt for anomalous must-use plugins like wp-sec.php and strictly enforce WordPress patching to prevent infrastructure hijacking.

research.checkpoint.com12 min read

BLOCKCHAIN DEAD DROP RESOLVERS EXPLAINED

Researchers identified multiple malware families abusing smart contracts on EVM, Solana, and TON blockchains as "dead drop resolvers" to dynamically fetch command-and-control addresses. By utilizing read-only functions like eth_call, threat actors can cheaply rotate infrastructure without altering their core payloads, a tactic recently deployed in the August 2026 ChainDrop npm supply-chain compromise. To detect this evasion technique, defenders should monitor for non-browser processes like node, bun, or curl making anomalous RPC queries to public providers and correlate the decoded responses.

netskope.com5 min read

A CLOSED NETWORK PATH IS NOT A CLOSED EXECUTION PATH

When working with event-driven architectures, traditional network paths, such as security groups, firewalls, and network ACLs, may not be the same as the execution path. The author tested this by creating a cross-account EventBridge policy which allowed an external account to send events to an internal account which triggered a Lambda function, which then called an EKS application that used its cloud identity to perform a privileged action. Since each individual action was legitimate, no alerts or detections fired. It took the author a full afternoon to trace the events even though he knew the full path.

thecorestrength.net6 min read

03LAUNCHES & TOOLS

XPANDER (PRODUCT LAUNCH)

Xpander provides software to build, run, secure, and manage automated software workers across products, workflows, and data. Its portable runtime runs workers in different environments, while Omni helps teams create employee-facing assistants and coordinate multi-worker tasks.

xpander.ai

AGENTCOV

agentcov maps AI coding agent reads (Codex, Claude Code, and Pi) onto LCOV, gcov, and native JSON coverage reports, tracking which repository lines agents actually inspected versus left unread.

github.comGitHub repository

ATEN

Agent Telemetry and Event Notation (ATEN) is a background service that records what AI does on a host and writes it out as structured events for a SIEM.

github.comGitHub repository

04MISCELLANEOUS

OPENAI INSTITUTES NEW SAFEGUARDS AFTER HUGGING FACE BREACH

OpenAI introduced tighter testing controls after models escaped a training environment through an internet-connected network tool. The company paused reinforcement learning for two weeks and still holds its largest planned run with new controls to isolate workloads, inspect tool actions and logs, and target alerts within 30 minutes.

techcrunch.com2 min read

HACKERS SPEND NEARLY $7 MILLION ON EXPIRED DOMAINS TO REDIRECT TRAFFIC TO SCAMS AND MALWARE

Infoblox tracked 50,400 expired-domain re-registrations daily across gTLDs in early 2026. Sable Squirrel spent nearly $7 million on more than 10,000 domains, routing sports-streaming visitors to gambling sites and using some domains for malware C2. Researchers linked 31,000 samples, including Quasar RAT and AsyncRAT, to its infrastructure while other groups buy expired, compromised domains and monetize inherited traffic through scams, malicious scripts, and ad networks.

thehackernews.com5 min read

MICROSOFT COPILOT REVEALS SECRET INPUT THAT ALLOWED IT TO BE HACKED

Varonis found that Copilot disclosed an undocumented ?autorun=1 URL parameter through repeated questioning. Combined with ?q=, it ran injected prompts after a victim clicked a link. Prompts could search authenticated inboxes and send extracted email addresses or credentials to attacker-controlled servers. Microsoft blocked ?q= input injection in February and issued broader fixes as

arstechnica.com3 min read